This document summarizes the key findings from a research study on TLS 1.3 adoption in enterprises. The study found that while some security and operational concerns exist with TLS 1.3, adoption is moving quickly, especially for inbound connections and internal traffic. Improved data security and privacy were the top motivators for organizations to adopt TLS 1.3. There are various strategies being considered for enabling TLS 1.3 while maintaining visibility, with maintaining existing firewalls and looking for inline alternatives being top strategies for large enterprises. Overall encryption use is growing in enterprises and TLS remains the primary transport encryption method.

1. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
PAULA MUSICH
Research Director
Enterprise Management Associates
TLS 1.3 Adoption
in the Enterprise
Growing Encryption Use Extends
to New Standard
IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING

2. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING2 © 2019 Enterprise Management Associates
Watch the On-Demand Webinar
• TLS 1.3 Adoption in the Enterprise: Growing
Encryption Use Extends to New Standard On-
Demand webinar is available here:
http://info.enterprisemanagement.com/tls13-
adoption-webinar-ws
• Check out upcoming webinars from EMA here:
http://www.enterprisemanagement.com/freeResearch

3. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING3 © 2019 Enterprise Management Associates
Today’s Speaker
PAULA MUSICH, Research Director, EMA
Paula brings over 30 years of experience covering the IT
security and networking technology markets. She has been
an IT security analyst for over nine years, most recently as a
research director at NSS Labs, and earlier as principal
analyst for enterprise security for Current Analysis. As a
security technology analyst Paula has tracked and analyzed
competitive developments in the threat management segment
of the information security market, ranging from advanced
anti-malware to next generation firewalls and intrusion
prevention systems to content security, data loss prevention
and more.

4. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING4 © 2019 Enterprise Management Associates
Logistics
An archived version of the event recording
will be available at
www.enterprisemanagement.com
• Log questions in the chat panel located on
the lower left-hand corner of your screen
• Questions will be addressed during the
Q&A session of the event
QUESTIONS
EVENT RECORDING

5. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING5 © 2019 Enterprise Management Associates
TSL 1.3 Adoption Research Sponsors

6. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING6 © 2019 Enterprise Management Associates
Agenda
• Introduction, Methodology, Demographics
• TLS 1.3 Adoption Key Findings
• Drivers Behind TLS 1.3 Enablement
• Tradeoffs with TLS 1.3
• Strategies for Enabling TLS 1.3
• Encryption Usage and Trends
• Wrap Up & Q&A

7. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
Introduction, Methodology,
Demographics

8. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
Introduction and Methodology
TLS 1.3 Finally Debuts
• 10 years in the making
• The benefits:
• Reduced latency
• End to end privacy
• Better end user experience
• The downsides
• Lost visibility for security and
troubleshooting
Methodology
• Survey 249 IT pros involved
in security and IT
management
• 67% security is primary role
• 40% IT
Director/Manager/Supervisor
• 15% CIO/CTO/VP-IT
• 12% CSO/CISO/IT Security
Director
8 © 2019 Enterprise Management Associates

9. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
Slide 9 © 2019 Enterprise Management Associates, Inc.
Demographics
• Company size
• 6% small enterprise (250-499 people)
• 12% midsized enterprise (500-999)
• 68% large enterprise (1,000-19,999)
• 13% very large enterprise (20,000 +)
• Revenue
• $10 to less than $20 million (4%)
• $20 million to <$100 million (29%)
• $100 million to 1 billion+ (33%)
• IT Budget
• 27% $1 million to <$10 million
• 23% $10 million to <$25 million
• 19% $25 million to <$50 million
• 12% $50 million to <$100 million
• 12% $100 million +
• Vertical Industries
• High Technology (29%)
• Finance/banking/insurance (16%)
• Retail/wholesale (13%)
• Healthcare/Pharma (10%)
• Telecommunications (8%)
• Education (7%)
• Geography
• Primarily serve North America
• Notable
• No more than 15% not aware of/not
involved in TLS 1.3 enablement
• 61% very familiar with TLS 1.3 on
technical level
• 42% part of technical enablement
team

10. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
TLS 1.3 Enablement
Key Findings

11. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING11 © 2019 Enterprise Management Associates
Yes, there are concerns…
Security and Operational Concerns for Enabling TLS 1.3
7%
37%
34%
22%
9%
30%
40%
21%
We are not at all
concerned
We are only slightly
concerned
We have some concerns
We have significant
concerns
Operational concerns Security concerns

12. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING12 © 2019 Enterprise Management Associates
But Enablement is Moving Full Steam Ahead
The big surprise is that enablement/adoption of TLS 1.3 is
moving quickly for inbound connections and internal traffic
2%
32%
41%
17%
6%
3%
40%
34%
14%
6%
Not planning to enable TLS 1.3
at this time
Already underway
Within 6 months
7-12 months
13-18 months
Inbound connections Internal traffic

13. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
Drivers Behind
TLS 1.3 Enablement

14. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING14 © 2019 Enterprise Management Associates
Why move to TLS 1.3?
Top motivations are privacy and data security
• 73% cite improved data security as a very important
motivator to adopt TLS 1.3 for their organizations
• 67% cite improved privacy for end to end security as a
very important motivator to adopt
• Only 44% cite decreased latency/TLS session setup
time as very important, despite 0-RTT advancement

15. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING15 © 2019 Enterprise Management Associates
Other reasons to move to TLS 1.3
Influence by the big boys – namely Apple, Google & Microsoft
63%
33%
3%
It forces us to accelerate our plan
It has no impact on our plan
It forces us to slow our plan down

16. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
Tradeoffs with TLS 1.3

17. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING17 © 2019 Enterprise Management Associates
Potential lost visibility a concern, but how much?
Lost visibility into inbound and internal traffic is a concern,
but no 5 alarm bells for some
9%
32%
24%
16%
19%
Not at all concerned
Somewhat concerned
Concerned
Very concerned
Extremely concerned

18. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING18 © 2019 Enterprise Management Associates
Lost Visibility Top Security Worries by Activity
Four potential issues caused by lost visibility and
level of concern
1. Monitoring Application Security tops the list
2. Detecting Lateral Attack Movement comes in 2nd
3. Troubleshooting Application Performance a distant 3rd
4. Detecting attacker reconnaissance not so much

19. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING19 © 2019 Enterprise Management Associates
Lost Visibility Top Security Worries by Location
No surprise data center tops the list
14%
24%
27%
13%
11%
4%
4%
4%
Campus
Core
Data center
Branch
Connection to cloud resources
East-west visibility for private cloud
East-west visibility for public cloud
DMZ

20. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING20 © 2019 Enterprise Management Associates
Certificate Encryption:
Better Privacy, Worse Security?
• TLS 1.3 Certificate Encryption Intent: Improve Privacy
• TLS 1.3 Certificate Encryption Impact: Poorer Security
• Use of free “Let’s Encrypt” SSL Certificate Authority drove dramatic
increase in usage of web’s HTTPS protocol
• Adoption rate of “Let’s Encrypt” by malware authors explodes
• Without visibility into certificate, you can’t see if the certificate was
self-signed by a malware author
• TLS 1.3 Certificate Encryption: Security or Operational
Issue?
• 38% more of a security issue
• 33% more of an operational issue
• 20% both

21. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
Strategies for
Enabling TLS 1.3

22. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING22 © 2019 Enterprise Management Associates
Enablement not a question of if…
Will enabling TLS 1.3 require a change in your security
architecture?
Yes, significant
change, 45%
Yes, but not
significant
change, 50%
No change,
5%

23. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING23 © 2019 Enterprise Management Associates
Enablement a question of how
• Respondents mulling multiple strategies for enabling
TLS 1.3
• Replace existing stateful inspection firewalls with proxy-
based firewalls
• Maintain existing firewalls at earlier versions of TLS for as
long as possible
• Look for inline alternatives that enable decryption and
inspection by existing security controls without exacting a
big performance penalty
• Enable decryption and re-encryption on existing inline
security devices and hope it that it doesn’t add too much
latency, complexity or security vulnerability
• Look for out of band decryption solutions that enable
decryption and inspection without exacting a significant
performance penalty
• Of the 5 different strategies, top choices varied by
size of organization

24. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING24 © 2019 Enterprise Management Associates
Top strategies for large/very large enterprises
56%
55%
48%
49%
52%
52%
43%
38%
Maintain existing firewalls at earlier versions of TLS for
as long as possible
Enable decryption and re-encryption on existing inline
security devices and hope that it doesn’t add too much
latency, complexity, or security vulnerability
Look for inline alternatives that enable decryption and
inspection by existing security controls without exacting
a significant performance penalty
Replace existing stateful inspection firewalls with
proxy-based firewalls
Enterprise (All) VL Enterprise

25. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING25 © 2019 Enterprise Management Associates
Top Strategies for Mid-sized Organizations
63%
53%
46%
45%
Maintain existing firewalls at earlier versions of TLS for
as long as possible
Look for inline alternatives that enable decryption and
inspection by existing security controls without exacting a
significant performance penalty
Enable decryption and re-encryption on existing inline
security devices and hope that it doesn’t add too much
latency, complexity, or security vulnerability
Replace existing stateful inspection firewalls with proxy-
based firewalls

26. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING26 © 2019 Enterprise Management Associates
Top Strategies for SMBs
8%
31%
38%
54%
69%
Look for out-of-band decryption solutions that enable
decryption and inspection without exacting a significant
performance penalty
Enable decryption and re-encryption on existing inline
security devices and hope that it doesn’t add too much
latency, complexity, or security vulnerability
Look for inline alternatives that enable decryption and
inspection by existing security controls without exacting a
significant performance penalty
Maintain existing firewalls at earlier versions of TLS for as
long as possible
Replace existing stateful inspection firewalls with proxy-
based firewalls

27. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
35%
27%
16%
Encryption growth expected in next 18 months
Expect 1% - 25%
growth
Expect 26% - 50%
growth
Expect 51% to
75% growth
27 © 2019 Enterprise Management Associates
TLS 1.3 in the Context of Broader
Encryption Practices
• Overall encryption use in the enterprise is growing, and
TLS is the transport encryption method of choice.
• 29% mandate TLS 1.2; 22% mandate TLS 1.1; 17% already
mandate TLS 1.3
• Encryption Growth by the Numbers
31%
30%
17%
Encryption growth over last 18 months
Increased 26% -
50%
Increased 1% -
20%
Increased by
51% to 75%

28. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING28 © 2019 Enterprise Management Associates
Q&A
Get the report
http://bit.ly/2HDgHAl